A graph-based threat intelligence analysis method for honeypot systems

Abstract

The invention relates to a graph-based honeypot system threat intelligence analysis method, comprising the following steps: using the honeypot system to collect behavior data of attackers; analyzing and extracting meta-information and derivative information derived from the meta-information; constructing a graph model, Save to the graph database; threat intelligence mining and analysis; provide the mining and analysis interface of the relationship between nodes, mining and analyzing the node information specified by the user, this method solves the problem that the existing technology cannot deeply mine the attack data collected by the honeypot system Problems can further mine and analyze the potential links in the attack data, understand the attacker's attack methods, provide a more accurate reference for the adjustment of the honeypot system architecture level, and provide effective information reference for attack traceability and attack forensics.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a graph-based honeypot system threat intelligence analysis method. Background technique [0002] With the rapid development of computer technology, information network has become an important guarantee for social development. Therefore, it is very important to ensure the security of information network. Therefore, it is necessary to formulate corresponding protection measures for various attack methods on the network to avoid network attacks. However, the premise of formulating the corresponding protection measures is to first understand the attacker's attack methods, but most of the attacker's methods are destructive. Therefore, in order to collect a large amount of attack data, honeypot technology is widely used in network security technology. Honeypot technology is essentially a technology to deceive the attacker. By arranging some hosts, network services or informati...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the problems existing in the above-mentioned prior art, the present invention discloses a graph-based honeypot system threat intelligence analysis method, which solves the problem that the existing technology cannot deeply mine the attack data collected by the honeypot system. This method is based on The graph model can further mine and analyze the potential connection in the attack data, so that users can further understand the attacker's attack method, provide a more accurate reference for the adjustment of the honeypot system architecture level, and also provide an effective tool for attack traceability and attack forensics. information reference

Images